Documenting a domain through hosting and promotional changes
A domain name can promise one publication and deliver something else entirely. tribratanews-pasuruan.com appears to present a cPanel hosting login, while earlier versions carried unrelated Mogeqq online card and dice gaming promotions. Its name suggests a Pasuruan news outlet in East Java, yet the observed pages reveal neither a functioning news service nor an identifiable local publisher. That mismatch makes this domain a useful case for documenting the timeline of a site switching between hosting and promotional pages, without assuming that a hack, a sale or an affiliate arrangement caused it.
The task is to build a defensible chronology, not a dramatic account of what probably happened. Australian readers need market-aware context: .com.au is a commercial namespace managed by auDA, while .id is Indonesia’s country-code namespace. Capture times should be tied to AEST or AEDT and, for Indonesian comparison, Western Indonesian Time (WIB), so observations from Sydney, Melbourne or Brisbane can be reconciled against the site’s intended audience.
Establish a dated evidence register
Begin with an evidence register, giving every observation a unique identifier and timestamp. Record the exact URL, including its path, the capture time in UTC and local time, the observing city, the HTTP status and visible text. Save a full-page screenshot and, where practical, a PDF or HTML copy, along with relevant response headers. Capture DNS records, name servers, registrar details, TLS certificate information and the favicon in separate fields, so an unchanged hosting account is not mistaken for unchanged content.
A guide to identifying repurposed news domains is relevant because it separates visible editorial evidence from infrastructure signals. A cPanel panel may share a recognisable design without proving who controls it; Mogeqq branding may prove promotion rather than ownership. Compare each dated observation with archived versions from the Internet Archive and other reputable web archives, noting gaps instead of treating an empty archive result as proof that a page never existed.
Use neutral labels such as “cPanel login visible” and “Mogeqq promotional content visible,” rather than “site hacked.” These labels record what an observer can support while leaving cause open for later testing.
Separate content, infrastructure and metadata
Content, infrastructure and metadata often move at different speeds, so compare them as separate layers.
| Signal | What it can support | Record carefully |
|---|---|---|
| cPanel login | A hosting interface was visible | Exact path, capture time and response headers |
| Mogeqq promotion | Gaming content appeared under that brand | Screenshots, destination links and visible terms |
| Pasuruan-style name | Possible Indonesian local-news intent | Publisher claims and language; intent remains unverified |
| Meta description | Search-facing positioning | Cached text compared with visible content |
| DNS or TLS continuity | Infrastructure remained in place | Dates, providers and every changed record |
Metadata needs particular caution because a stale description can survive a complete redesign. The method in metadata consistency analysis helps separate a page’s claimed subject from its actual content. A description mentioning Indonesian news, beside a hosting login or gaming promotion, is a discrepancy worth recording, not evidence that either service had editorial authority. Record the description, title, canonical link and language tags exactly as served, then compare them with screenshots and archived copies taken as close together as possible.
Preserve transitions and visual context
Still screenshots prove a state, not the interval between states. Record when redirects occur, whether a login panel is reached directly or after several hops, and whether promotional links point to the same brand, an affiliate domain or an unrelated service. Browser network logs can show those redirects, but store them in a format that another researcher can open without relying on the original browsing session.
Video can preserve timing, but it must remain traceable to its source. The Recap Project’s account of time-remapped video sequences demonstrates why frame order and playback speed affect interpretation; evidence about a changing landing page should therefore retain the original recording and an unmodified sequence. Save the source file, a working copy, capture settings and a hash where collection rules permit. Screen recordings are especially useful for transitions that a periodic screenshot would miss.
Never enter credentials on an unfamiliar login panel. Australian Cyber Security Centre guidance favours preserving relevant logs and avoiding actions that alter evidence, so public collection should stop at the visible login screen.
Describe cause without overstating evidence
Multiple explanations can fit the same observation. A compromised server, a legitimate hosting account, a parked domain, a changed owner and a promotional redirect all deserve testing. The presence of cPanel identifies an interface, not the operator; the disappearance of news content identifies a state, not a breach. Without records from the original publisher, a registrar, an archive or the machine that hosted the site, motive remains unverified.
Keep observations, interpretations and unresolved questions in distinct notes. This matters in the Australian market because online gambling promotions are a familiar advertising category, with state rules differing across New South Wales and Victoria. A Mogeqq page seen in Australia may reflect geo-targeting, an overseas publisher or copied branding. Region-specific captures, language and currency details can narrow those possibilities, but an Australian visitor’s screen alone cannot establish where the campaign originated.
Before publishing captures, redact Australian personal information, private email addresses and payment details. Those artefacts can identify people without helping establish who controlled the domain.
Close the record with a dated next step
Turn the evidence into a short, chronological account that states what was observed, when, and with what confidence. Useful entries pair a screenshot with its capture metadata, headers, DNS result and archive reference. Distinguish direct observations from links between them, and note any inaccessible pages, failed requests or collection limits. A timeline that admits uncertainty is more durable than one built around an unverified motive.
Preserve the register in a durable format, export a copy for independent review and retain enough provenance for another observer to repeat the capture. The immediate next step is a timestamped full-page capture of the domain’s current landing page, saved as entry one of the evidence register.